UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15113

Directories created via os.MkdirAll are not checked for permissions

Severity
High 7.1
Published
5 Aug 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.3.23, 3.4.10
Also known as
GHSA-chh6-ppwq-jh92
Sources
NVD, Project advisories (GitHub)

Description

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible…

Affected software

SoftwareAffected versions
etcdServers and applications · cpe:a:etcd:etcd
  • Every version before 3.3.23
  • From 3.4.0 before 3.4.10
etcdServers and applications · github:etcd-io/etcd
  • Every version before 3.3.23

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15113
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15113
  • GitHub Advisory Database https://github.com/advisories/GHSA-chh6-ppwq-jh92
  • github.com https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92